6 ms·

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins

I find authentication the least problematic place where risk based on ip is used. Etsy, for example, will suspend your seller account if it sees too many logins from different IPs or if it's from an IP it has flagged before. It also has terrible seller customer service so it could take weeks to get it un-suspended. Heard of some people using Private Relay getting hit by this during the beta so hopefully Etsy gets rid of that system.

ffo 5y ago
True it applies to other services as well. I just scoped my IMO to our Identity and Access Management World.
fps_doug 5y ago
Compared to Google, where you can't contact anybody at all if you're not on a payed account. Yes, it's free, why do you expect service, but they're still making money off me with ads etc., so locking an account down forever because of suspicious activity seems a bit over the top in that case.
- marcinzm 5y ago
  Sometimes Etsy customer service will just say "we no longer have a business relationship and we cannot talk further<disconnect>". So it may be weeks using un-documented email addresses and escalation processes that you only learn about on unofficial subreddits.
- dannyw 5y ago
  Etsy is a commercial marketplace, it's as free as your local Walmart is free.
headmelted 5y ago
They will be forced to. That’s what’s different with iCloud relay - Apple’s weight to force changes upstream. Either Etsy changes their policy now during the beta (my guess is they will), or they change it in a panic in November when iPhones can no longer access the site to buy anything. (No-one is going to switch off private relay to convenience a single website).
- marcinzm 5y ago
  >(No-one is going to switch off private relay to convenience a single website) If you're a seller and a decent chunk of your income comes from Etsy you definitely would. They already do that with avoiding VPNs to not get suspended.
  - novok 5y ago
    Etsy does something similar with vpns where they serve a blank page if you try to access it. They don’t even throw up an error message. That prevents buyers from buying also. Etsy will adapt, quickly.
  - barkerja 5y ago
    How many average Etsy users do you think would know that iCloud Private Relay is the cause of their issues?
    - danudey 5y ago
      They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!" At least, it would if their Etsy accounts weren't getting locked until they can contact support. That said, the Etsy app won't be subject to Private Relay, so if the functionality is there then a lot of users won't have to worry about it as much.
      - user-the-name 5y ago
        > That said, the Etsy app won't be subject to Private Relay Why? As far as I know it will apply to apps as well.
        danudey 5y ago
        Per the WWDC talk on it: https://developer.apple.com/videos/play/wwdc2021/10096/ https://developer.apple.com/videos/play/wwdc2021/10096/ > In iOS 15 and macOS 12, Private Relay will apply to all web browsing in Safari, all DNS name resolution queries, and a small subset of traffic from apps. > Specifically, this will include all insecure HTTP traffic, such as TCP port 80. This implies that app traffic won't apply to HTTPS traffic, which supports my assertion, but then later in the video: > Not all networking done by your app occurs over the public internet, so there are several categories of traffic that are not affected by Private Relay. > Any connections your app makes over the local network or to private domain names will be unaffected. > Similarly, if your app provides a network extension to add VPN or app-proxying capabilities, your extension won't use Private Relay and neither will app traffic that uses your extension. > Traffic that uses a proxy is also exempt. So this says that HTTPS traffic will be included, which disproves my assertion, and seems more likely to be true.
tinus_hn 5y ago
Just like no one will block gmail for sending spam, no one is going to block Apple
cglong 5y ago
My guess is that they'll just say Safari isn't supported and push people to Chrome.
- djrogers 5y ago
  You can’t really do that for iOS. Sure, I mean you technically could, but mobile chrome usage is so low that the blowback would be enormous.
- crooked-v 5y ago
  Chrome on iOS is also Safari.
- r00fus 5y ago
  Hmm - and alienate anyone on mobile Safari? I doubt it.
  - zikduruqe 5y ago
    And why no one will block the egress IP ranges.
- dlivingston 5y ago
  They absolutely will not. Let’s say ~30% of Etsy.com views are through Safari (iOS + macOS; ignoring that Chrome on iOS is a viewframe around WebKit anyway). Of those, 25% have iCloud+. Let’s say they did this and 50% of people did visit the site through Chrome. That’s ~4% less revenue for them. I don’t know what Etsy makes per year, but ~4% of whatever that is will be on the order of millions of dollars. So, this is a no-brainer.
  - danudey 5y ago
    This is an interesting breakdown, but here's my analysis: Let's say that ~100% of Etsy.com views are through Safari. Of those, 100% have iCloud+. Let's say they did this and 0% of people visit the site through chrome. That's 100% less revenue for them. Pretty amazing that this one feature could completely kill Etsy's revenue stream. (For what it's worth, I agree with you that Etsy is not going to tell Safari users to pound sand, but your arbitrary numbers don't make an actual point unless they're based in facts and figures.)
yunohn 5y ago
> I find authentication the least problematic place where risk based on ip is used. I’m not an expert on Risk Based authentication, but your Etsy example sounds exactly like RBA. They use IP address as a factor in determining the risk associated with allowing the login, and suspend accounts with random IPs to prevent the “attacker” from wreaking havoc. RBA: https://en.wikipedia.org/wiki/Risk-based_authentication https://en.wikipedia.org/wiki/Risk-based_authentication
Wowfunhappy 5y ago
I personally would like the ability to—for example—disable logging into my password manager from outside the US. It's been a decade since I last left the country (no particular reason), and if that changes, I can change the setting before I leave. Could an attacker use a VPN? Sure—and there are also plenty of evildoers in the US. But it's an extra barrier. What I really don't want, however, is for my password manager (or any other service) to make these decisions for me. I will probably travel some day, and when I do, I don't want to be locked out of my account due to "unusual traffic" (yes, it is unusual for me to travel, that doesn't mean it won't happen).
brisance 5y ago
This was happening to me on Instagram as well. Using CloudFlare WARP+ and Instagram would deactivate my account arbitrarily. Figured it out only when I turned it off and the issues went away.

ffo 5y ago

True it applies to other services as well. I just scoped my IMO to our Identity and Access Management World.

fps_doug 5y ago

Compared to Google, where you can't contact anybody at all if you're not on a payed account. Yes, it's free, why do you expect service, but they're still making money off me with ads etc., so locking an account down forever because of suspicious activity seems a bit over the top in that case.

marcinzm 5y ago
Sometimes Etsy customer service will just say "we no longer have a business relationship and we cannot talk further<disconnect>". So it may be weeks using un-documented email addresses and escalation processes that you only learn about on unofficial subreddits.
dannyw 5y ago
Etsy is a commercial marketplace, it's as free as your local Walmart is free.

headmelted 5y ago

They will be forced to. That’s what’s different with iCloud relay - Apple’s weight to force changes upstream. Either Etsy changes their policy now during the beta (my guess is they will), or they change it in a panic in November when iPhones can no longer access the site to buy anything. (No-one is going to switch off private relay to convenience a single website).

marcinzm 5y ago
>(No-one is going to switch off private relay to convenience a single website) If you're a seller and a decent chunk of your income comes from Etsy you definitely would. They already do that with avoiding VPNs to not get suspended.
- novok 5y ago
  Etsy does something similar with vpns where they serve a blank page if you try to access it. They don’t even throw up an error message. That prevents buyers from buying also. Etsy will adapt, quickly.
- barkerja 5y ago
  How many average Etsy users do you think would know that iCloud Private Relay is the cause of their issues?
  - danudey 5y ago
    They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!" At least, it would if their Etsy accounts weren't getting locked until they can contact support. That said, the Etsy app won't be subject to Private Relay, so if the functionality is there then a lot of users won't have to worry about it as much.
    - user-the-name 5y ago
      > That said, the Etsy app won't be subject to Private Relay Why? As far as I know it will apply to apps as well.
      - danudey 5y ago
        Per the WWDC talk on it: https://developer.apple.com/videos/play/wwdc2021/10096/ https://developer.apple.com/videos/play/wwdc2021/10096/ > In iOS 15 and macOS 12, Private Relay will apply to all web browsing in Safari, all DNS name resolution queries, and a small subset of traffic from apps. > Specifically, this will include all insecure HTTP traffic, such as TCP port 80. This implies that app traffic won't apply to HTTPS traffic, which supports my assertion, but then later in the video: > Not all networking done by your app occurs over the public internet, so there are several categories of traffic that are not affected by Private Relay. > Any connections your app makes over the local network or to private domain names will be unaffected. > Similarly, if your app provides a network extension to add VPN or app-proxying capabilities, your extension won't use Private Relay and neither will app traffic that uses your extension. > Traffic that uses a proxy is also exempt. So this says that HTTPS traffic will be included, which disproves my assertion, and seems more likely to be true.

tinus_hn 5y ago

Just like no one will block gmail for sending spam, no one is going to block Apple

cglong 5y ago

My guess is that they'll just say Safari isn't supported and push people to Chrome.

djrogers 5y ago
You can’t really do that for iOS. Sure, I mean you technically could, but mobile chrome usage is so low that the blowback would be enormous.
crooked-v 5y ago
Chrome on iOS is also Safari.
r00fus 5y ago
Hmm - and alienate anyone on mobile Safari? I doubt it.
- zikduruqe 5y ago
  And why no one will block the egress IP ranges.
dlivingston 5y ago
They absolutely will not. Let’s say ~30% of Etsy.com views are through Safari (iOS + macOS; ignoring that Chrome on iOS is a viewframe around WebKit anyway). Of those, 25% have iCloud+. Let’s say they did this and 50% of people did visit the site through Chrome. That’s ~4% less revenue for them. I don’t know what Etsy makes per year, but ~4% of whatever that is will be on the order of millions of dollars. So, this is a no-brainer.
- danudey 5y ago
  This is an interesting breakdown, but here's my analysis: Let's say that ~100% of Etsy.com views are through Safari. Of those, 100% have iCloud+. Let's say they did this and 0% of people visit the site through chrome. That's 100% less revenue for them. Pretty amazing that this one feature could completely kill Etsy's revenue stream. (For what it's worth, I agree with you that Etsy is not going to tell Safari users to pound sand, but your arbitrary numbers don't make an actual point unless they're based in facts and figures.)

yunohn 5y ago

> I find authentication the least problematic place where risk based on ip is used. I’m not an expert on Risk Based authentication, but your Etsy example sounds exactly like RBA. They use IP address as a factor in determining the risk associated with allowing the login, and suspend accounts with random IPs to prevent the “attacker” from wreaking havoc. RBA: https://en.wikipedia.org/wiki/Risk-based_authentication https://en.wikipedia.org/wiki/Risk-based_authentication

Wowfunhappy 5y ago

I personally would like the ability to—for example—disable logging into my password manager from outside the US. It's been a decade since I last left the country (no particular reason), and if that changes, I can change the setting before I leave. Could an attacker use a VPN? Sure—and there are also plenty of evildoers in the US. But it's an extra barrier. What I really don't want, however, is for my password manager (or any other service) to make these decisions for me. I will probably travel some day, and when I do, I don't want to be locked out of my account due to "unusual traffic" (yes, it is unusual for me to travel, that doesn't mean it won't happen).

brisance 5y ago

This was happening to me on Instagram as well. Using CloudFlare WARP+ and Instagram would deactivate my account arbitrarily. Figured it out only when I turned it off and the issues went away.